Replace canvas share SAS links with an authenticated viewer

docs/spec/canvas-pane.md

@@ -87,7 +87,7 @@ A `SystemView` drives its own updates, so it needs neither morph nor the author
 - Selecting a tab marks that doc viewed.
 - Viewed but inactive tabs render at 0.5 opacity. The active tab stays full opacity.
 - The archive button moves the active doc to `.agents/canvas/archive/`. It is shown only when the active doc is an `AgentDoc` — a `SystemView` is server-regenerated, not user-owned, so it has no archive button.
-- The share button publishes the active doc to an unguessable, auto-expiring URL and copies a rich titled link to the clipboard. Like archive, it is shown only when the active doc is an `AgentDoc` — a `SystemView` is server-generated, not shareable, so it has no share button. Clipboard success uses the shared, dismissible `ClipboardNotice` channel (green), independent of the send `Waiting` and delivery-`Failed` banners: a successful publish shows `Shared — link copied` (or `Shared — link ready, copy it manually: <url>` when the async clipboard write is rejected), while a *failed* publish reuses the existing red `CanvasSendState.Failed` error banner. Success and failure are mutually exclusive — each result arm clears the other channel — so a red + green stack never renders. Share cannot start while a path copy is pending, and path copy cannot start until Share has completed its publish and clipboard phases. See `docs/spec/canvas-sharing.md` for the full publish/SAS/clipboard flow.
+- The share button publishes the active doc to an unguessable, auto-expiring authenticated-viewer URL and copies a rich titled link to the clipboard. Like archive, it is shown only when the active doc is an `AgentDoc` — a `SystemView` is server-generated, not shareable, so it has no share button. Clipboard success uses the dismissible `ClipboardNotice` channel (green), independent of the send `Waiting` and delivery-`Failed` banners: a successful publish shows `Shared — link copied` (or `Shared — link ready, copy it manually: <url>` when the async clipboard write is rejected), while a *failed* publish reuses the existing red `CanvasSendState.Failed` error banner. Success and failure are mutually exclusive — each result arm clears the other channel — so a red + green stack never renders. Share cannot start while a path copy is pending, and path copy cannot start until Share has completed its publish and clipboard phases. See `docs/spec/canvas-sharing.md` for the full publish/viewer/clipboard flow.
 
 ### Canvas Overview
 
@@ -335,7 +335,7 @@ changed rows already use).
 
 - `docs/spec/worktree-monitor.md` — parent dashboard architecture spec
 - `docs/spec/beadspace-canvas.md` — beads dashboard integration in the canvas pane
-- `docs/spec/canvas-sharing.md` — one-click Share of a focused `AgentDoc` to an unguessable, auto-expiring URL (the tab-bar Share button, its publish/SAS backend, and the clipboard rich link)
+- `docs/spec/canvas-sharing.md` — one-click Share of a focused `AgentDoc` to an unguessable, auto-expiring authenticated-viewer URL (the tab-bar Share button, private-Blob publisher, and clipboard rich link)
 - `docs/spec/canvas-interaction-routing.md` — ownership, generated-view affinity, queueing, and session routing
 - `docs/spec/worktree-diff-viewer.md` — generated worktree diff SystemView
 - `docs/spec/future/canvas-roadmap.md` — remaining canvas work (authoring DX, templates)

docs/spec/future/code-improvements.md

@@ -38,7 +38,6 @@ its own worktree. This file is the entry point; detailed designs live in their o
 | 3 | **Canvas roadmap items** — follow-on canvas-pane enhancements | `docs/spec/future/canvas-roadmap.md` | Idea |
 | 4 | **Process: guard against spec drift** — a lightweight check (or review rule) that flags `Key Files` references to moved/renamed modules so docs can't silently rot after refactors | — | Idea |
 | 5 | **Survey other large modules** — *investigated.* `RefreshScheduler.fs` and `WorktreeApi.fs` both mix concerns; the concrete split is broken out as #8 below (and #7, the `GlobalConfig` extract, now *Done*). `WorktreeDiff.fs` is tracked separately as #13. (Strict-FP smells are already clean: no stray `let mutable`/loops/`null` in production; `Dictionary` only at cache/registry boundaries.) | — | Done (survey) |
-| 6 | **Remoting CSRF / Origin hardening** — pipeline-level Origin/Referer check so a cross-origin browser page can't drive the unauthenticated loopback Fable.Remoting API (covers the dangerous pre-existing process-launching endpoints, not just watched-roots) | `docs/spec/remoting-csrf-hardening.md` | **Done** — shipped on `quicklaunch` (`HttpSecurity.csrfGuard`) |
 | 8 | **Split `RefreshScheduler.fs`** — the `DashboardState`/`StateMsg`/`processMessage` state slice now lives in `SchedulerState.fs`; the embedded `CanvasWatchers` filesystem-watcher module (~110 L) still sits inside the scheduling loop and can follow the same seam. | — | Partly done (state slice extracted) |
 | 10 | **Share the `WorktreeDiffTests` git fixture** — the suite creates a real repository per test in `[<SetUp>]` (`initRepoOnMain`), making it the single largest contributor to Fast-suite runtime. Build the repository once in `[<OneTimeSetUp>]` and give each test its own branch or clone. | — | Idea |
 | 11 | **Fast-suite runtime exceeds its documented budget** — AGENTS.md advertises `<60s` for `Category=Fast`; the suite has been several times that for a while, dominated by browser-driven fixtures (`DashboardTests`, `CreateWorktreeServerTests`, `ArchiveTests`) plus #10. Either bring the suite back under budget or correct the figure, because a stale number stops it acting as a gate. | — | Idea |

docs/spec/process-execution.md

@@ -169,5 +169,5 @@ not a settled one.
 ## Related Specs
 
 - `docs/spec/worktree-diff-viewer.md` — request-scoped deadline and byte-oriented Git consumers.
-- `docs/spec/remoting-csrf-hardening.md` — the other pipeline-level hardening of the same
+- `docs/spec/worktree-monitor.md` — the loopback request boundary protecting the same
   process-launching surface.

docs/spec/session-status-push.md

@@ -258,5 +258,5 @@ projection but persists the complete count-only aggregate independently; see
 - `docs/spec/overview-activity-history.md` - durable canonical Overview snapshots.
 - `docs/spec/overview-drilldown.md` - per-group session details.
 - `docs/spec/resume-last-session.md` - resume command behavior.
-- `docs/spec/remoting-csrf-hardening.md` - endpoint origin protection.
+- `docs/spec/worktree-monitor.md` - endpoint origin protection.
 - `docs/spec/native-session-management.md` - terminal/window liveness, distinct from push openness.